CN103516713A - Facilitating and authenticating transactions - Google Patents
Facilitating and authenticating transactions Download PDFInfo
- Publication number
- CN103516713A CN103516713A CN201310246532.9A CN201310246532A CN103516713A CN 103516713 A CN103516713 A CN 103516713A CN 201310246532 A CN201310246532 A CN 201310246532A CN 103516713 A CN103516713 A CN 103516713A
- Authority
- CN
- China
- Prior art keywords
- data
- authentication
- message
- store device
- authenticate
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004891 communication Methods 0.000 claims description 98
- 238000000034 method Methods 0.000 claims description 94
- 238000012545 processing Methods 0.000 claims description 88
- 230000005540 biological transmission Effects 0.000 claims description 31
- 230000004069 differentiation Effects 0.000 claims description 16
- 230000007246 mechanism Effects 0.000 claims description 10
- 238000012546 transfer Methods 0.000 claims description 4
- 238000010295 mobile communication Methods 0.000 claims description 2
- 230000004044 response Effects 0.000 abstract description 14
- 230000001413 cellular effect Effects 0.000 abstract description 7
- BHELIUBJHYAEDK-OAIUPTLZSA-N Aspoxicillin Chemical compound C1([C@H](C(=O)N[C@@H]2C(N3[C@H](C(C)(C)S[C@@H]32)C(O)=O)=O)NC(=O)[C@H](N)CC(=O)NC)=CC=C(O)C=C1 BHELIUBJHYAEDK-OAIUPTLZSA-N 0.000 description 26
- 230000008569 process Effects 0.000 description 14
- 230000006870 function Effects 0.000 description 13
- 238000007726 management method Methods 0.000 description 9
- 238000012795 verification Methods 0.000 description 8
- 238000004088 simulation Methods 0.000 description 6
- 238000003860 storage Methods 0.000 description 6
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 241001269238 Data Species 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 238000007789 sealing Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3229—Use of the SIM of a M-device as secure element
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2103—Challenge-response
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2129—Authenticate client device independently of the user
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Computing Systems (AREA)
- Finance (AREA)
- Software Systems (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
A computer, such as a Windows-based PC 23, has associated with it a Subscriber Identity Module SIM (15), such as of the type used in a GSM or UMTS cellular or mobile telecommunications network. The SIM 15 can be authenticated with the network 3 in the same way as for authenticating SIMs of mobile telephone handsets used in the network, and can in this way authenticate the user of the PC 23 or the PC 23 itself. Such authentication can, for example, permit use of the PC 23 in relation to a particular application running on the PC 23. Challenge and response messages are transmitted between the network 3 and the SIM 15 via an authenticator module 30 implemented on the PC 23. These authentication messages have the predetermined format of an Over The Air (OTA) message, which is also used in GSM or UMTS telecommunications networks to transmit non-authentication messages - for example, SMS messages. The authentication data is encapsulated within OTA messages. The OTA messages are not necessarily transmitted wirelessly (that is, over the air). They may be transmitted via a fixed network; however, they have the predetermined format of OTA messages.
Description
Technical field
The help that the present invention relates to affairs realizes (facilitation) and authentication.Below by the embodiments of the invention that are only described in more detail by example, help to realize and verify data treatment facility (such as personal computer) or its user and (may be long-range) third party between affairs, and such help realization and authenticating may also relate to by user, undertaken or representative of consumer to third-party payment or transfer of data.
Summary of the invention
According to an aspect of the present invention, provide a kind of method of certification entity, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each.
In said method, described message format is corresponding to aerial (OTA) message format that transmits.
In said method, described authentication store device (15) comprises smart card.
In said method, described authentication store device (15) comprises Subscriber Identity Module or SIM.
In said method, described authentication store device (15) comprises for utilizing GSM or UMTS(3G) mobile telecom network authenticates the data of described entity.
In said method, the authentication information being stored on authentication store device (15) can be used for utilizing mobile telecom network authentication mobile phone handheld device.
In said method, described authenticate device (15) is relevant to GSM or UMTS mobile telecom network.
In said method, described communication network comprises GSM or UMTS mobile telecom network.
In said method, described communication network comprises internet.
In said method, described authentication store device (15) is coupled to carrier (32).
Said method comprises authentication store device (15) is coupled to data processing equipment (23), so that the affairs that authentication is used this data processing equipment (23) to carry out.
In said method, message is transmitted via described data processing equipment (23).
Said method comprises via carrier (32) described authentication store device (15) is coupled to described data processing equipment (23).
In said method, described message is transferred to described authentication store device (15) via described carrier (32).
In said method, described message comprises for reminding described carrier to obtain the element of identity data.
In said method, described identity data comprises PIN or biological attribute data.
In said method, described identity data is transferred to described authenticate device.
In said method, described message comprises for by these message and the differentiation element separating for transmitting the message area of non-verify data.
In said method, described differentiation element is explained by described authentication store device (15).
In said method, described authentication store device (15) and described authenticate device (50) are equipped with corresponding encryption and decryption mechanism.
Said method is included in sets up a kind of in described mechanism and according to the data in message described in this encryption mechanism between described authentication store device (15) and authenticate device (50).
In said method, via basic input/output (BIOS) certified transmission data between this data processing equipment (23) and described authentication store device (15) of described data processing equipment (23).
In said method, described data processing equipment (23) and described mobile telecom network (3) radio communication.
In said method, described data processing equipment (23) comprises mobile communications data card.
Said method comprises from described data processing equipment (23) to authentication store device (15) transfer of security data, use authentication store device (15) to check the validity of this secure data, and only have definite secure data effectively just to exchange selected data with data processing equipment (23).
Said method comprise do not consider the existence of described secure data or validity and with data processing equipment (23) exchange tentation data.
In said method, described message comprises from the inquiry of described authenticate device (50) with from the corresponding answer of authentication store device (15).
According to a further aspect in the invention, provide a kind of equipment for certification entity, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information; Authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity; It is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9) for transmitting non-verify data.
In the said equipment, described message format is corresponding to aerial (OTA) message format that transmits.
The said equipment comprises for carrying out the device of preceding method.
According to a further aspect in the invention, a kind of authentication store device (15) for certification entity is provided, on this authentication store device, store authentication information, this authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity; It is characterized in that for have communication network (3) described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9) for transmitting non-verify data.
In above-mentioned authentication store device, described message format is corresponding to aerial (OTA) message format that transmits.
In above-mentioned authentication store device, described authentication store device (15) comprises smart card.
In above-mentioned authentication store device, described authentication store device (15) comprises subscriber identification module or SIM.
In above-mentioned authentication store device, described authentication store device (15) comprises for utilizing GMS or UMTS(3G) mobile telecom network authenticates the data of described entity.
In above-mentioned authentication store device, the authentication information being stored on authentication store device (15) can be used for utilizing described mobile telecom network (3) authentication mobile phone (1) handheld device.
Above-mentioned authentication store device comprises for carrying out the device of preceding method.
According to a further aspect in the invention, provide a kind of method of certification entity, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, and wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of equipment for certification entity, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information; Authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity; It is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9), for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, a kind of authentication store device (15) for certification entity is provided, on this authentication store device, store authentication information, this authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity; It is characterized in that for have communication network (3) described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9), for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide the method for a kind of certification entity with the affairs of execution and service provider (40), the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Described authentication store device (15) is coupled to data processing equipment (23) to authenticate this affairs, and these affairs are used described data processing equipment (23) to carry out; Described service provider (40) generates service context (Sc) and this service context is sent to described data processing equipment (23), and described service context (Sc) can be analyzed to determine the authentication that needs described affairs by described data processing equipment (23); Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity, described authenticate device (50) generates security token (Sx) when authentication occurs, and this security token is sent to described data processing equipment (23); Described data processing equipment (23) passes to described service provider (40) by described security token; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message is transmitted via described data processing equipment (23), and wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the equipment with the business of service provider (40), this equipment comprises authentication store device (15), on this authentication store device, stores authentication information, data processing equipment (23), for being coupled to described authentication store device (15) to authenticate described business, described business is used described data processing equipment (23) to carry out, described service provider (40) can be used to and generates service context (Sc) and this service context is sent to described data processing equipment (23) to determine the authentication that needs described business, authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity, described authenticate device (50) can be used to when authentication occurs and generates security token (Sx) and this security token is sent to described data processing equipment (23), described data processing equipment (23) can be used to by described security token (Sx) pass to described service provider (40) it is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, wherein this message is transmitted via described data processing equipment (23), wherein this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the authentication store device (15) with the business of service provider (40), on this authentication store device, store authentication information, this authentication store device (15) can be connected to data processing equipment (23) to authenticate described business, and described business is used described data processing equipment (23) to carry out; Described service provider (40) can be used to and generates service context (Sc) and this service context is sent to described data processing equipment (23), described service context (Sc) can analyze to determine the authentication that needs described business by described data processing equipment (23), and this authentication store device is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity; Described authenticate device (50) can be used to when authentication occurs and generates security token (Sx) and this security token is sent to described data processing equipment (23); Described data processing equipment (23) can be used to described security token (Sx) is passed to described service provider (40); And it is characterized in that for have communication network (3) described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit the device of described data, wherein this message is transmitted via described data processing equipment (23), wherein this message format can also be by element described in each (5,7,9), for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of method of certification entity, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information, via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity, it is characterized in that described data element (5 described in each in thering is communication network, 7, 9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message comprises from the inquiry of described authenticate device (50) and the corresponding answer to described authenticate device (50) from described authentication store device (15), described answer is analyzed by described authenticate device (50) to determine that whether described answer is as expected from described authentication store device (15), and wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of equipment for certification entity, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information, authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity, it is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message comprises from the inquiry of described authenticate device (50) and the corresponding answer to described authenticate device (50) from described authentication store device (15), described answer is analyzed by described authenticate device (50) to determine that whether described answer is as expected from described authentication store device (15), and wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, a kind of authentication store device (15) for certification entity is provided, on this authentication store device, store authentication information, this authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity, it is characterized in that for thering is communication network (3) element (5 described in each, 7, 9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message comprises from the inquiry of described authenticate device (50) and the corresponding answer to described authenticate device (50) from described authentication store device (15), described answer is analyzed by described authenticate device (50) to determine that whether described answer is as expected from described authentication store device (15), and wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message.
According to a further aspect in the invention, provide a kind of method of certification entity, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of equipment for certification entity, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information; Authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity; It is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9) for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, a kind of authentication store device (15) for certification entity is provided, on this authentication store device, store authentication information, this authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity; It is characterized in that for have communication network (3) described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9) for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of certification entity to carry out the method for business, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Described authentication store device (15) is coupled to data processing equipment (23) to authenticate described business, and described business is used described data processing equipment (23) to carry out; Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the equipment of business, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information, data processing equipment (23), for being coupled to described authentication store device (15) to authenticate described business, described business is used described data processing equipment (23) to carry out, authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) be coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity, it is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the authentication store device (15) of business, on this authentication store device, store authentication information, described authentication store device (15) can be coupled to data processing equipment (23) to authenticate described business, described business is used described data processing equipment (23) to carry out, and described authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7, 9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity, it is characterized in that for thering is communication network (3) element (5 described in each, 7, 9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, and wherein said message comprises for by those message and the differentiation element separating for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of certification entity to carry out the method for business, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information, described authentication store device (15) is coupled to data processing equipment (23) to authenticate described business, and described business is used described data processing equipment (23) to carry out, via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity, it is characterized in that described data element (5 described in each in thering is communication network, 7, 9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the equipment of business, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information, data processing equipment (23), for being coupled to described authentication store device (15) to authenticate described business, described business is used described data processing equipment (23) to carry out, authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) be coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity, it is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the authentication store device (15) of business, on this authentication store device, store authentication information, described authentication store device (15) can be coupled to data processing equipment (23) to authenticate described business, described business is used described data processing equipment (23) to carry out, and described authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7, 9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity, it is characterized in that for thering is communication network (3) element (5 described in each, 7, 9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message is transmitted via described data processing equipment (23), wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data.
According to a further aspect in the invention, provide a kind of certification entity to carry out the method for business, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information, described authentication store device (15) is coupled to data processing equipment (23) to authenticate described business, and described business is used described data processing equipment (23) to carry out, via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity, it is characterized in that described data element (5 described in each in thering is communication network, 7, 9) can identify and the message of the message format that can transmit in transmit, this message format can also be used for transmitting non-verify data by element described in each, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data, and wherein said message transmits via described data processing equipment (23) but described data processing equipment can not be accessed the content of described message, because described message utilizes selected cipher key sets to encrypt.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the equipment of business, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information, data processing equipment (23), for being coupled to described authentication store device (15) to authenticate described business, described business is used described data processing equipment (23) to carry out, authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) be coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity, it is characterized in that for have communication network (3) described in each element can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5, 7, 9) for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data, and wherein said message transmits via described data processing equipment (23) but described data processing equipment can not be accessed the content of described message, because described message utilizes selected cipher key sets to encrypt.
According to a further aspect in the invention, provide a kind of for certification entity to carry out the authentication store device (15) of business, on this authentication store device, store authentication information, described authentication store device (15) can be coupled to data processing equipment (23) to authenticate described business, described business is used described data processing equipment (23) to carry out, and described authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7, 9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity, it is characterized in that for thering is communication network (3) element (5 described in each, 7,9) can identify and the message of the message format that can transmit in transmit the device of described data, this message format can also be by element described in each (5,7,9) for transmitting non-verify data, wherein said message format is corresponding to aerial transmission (OTA) message format that is suitable for transmitting SMS text message, wherein said authentication store device (15) and described authenticate device (50) are provided with a plurality of counterpart keys set, and wherein said message comprises for by those message and the differentiation element and the indication with the selected cipher key sets of a plurality of cipher key sets of communicating by letter of described authentication store device (15) for encrypt/decrypt that separate for transmitting the message area of non-verify data, and wherein said message transmits via described data processing equipment (23) but described data processing equipment can not be accessed the content of described message, because described message utilizes selected cipher key sets to encrypt.
Accompanying drawing explanation
With reference to the accompanying drawings, only with the form of example, describe according to of the present invention for helping to realize and authentication relates to method, equipment and the authentication store device such as the affairs of the embodiment data processing equipment of the present invention of personal computer.
Fig. 1 shows the primary element of communication network;
Fig. 2 is for explaining the block diagram of the operation of the method relevant to data processing equipment;
Fig. 3 is the perspective view of a kind of configuration of Doyle chip (dongle); And
Fig. 4 is for understanding the flow chart of the foundation of the communication channel between SIM and Virtual network operator;
Fig. 5 A and 5B are for understanding the flow chart of the verification process of being carried out by the data processing equipment of Fig. 2.
Similar element carrys out mark with identical reference number conventionally in the accompanying drawings.
Embodiment
When relating to the affairs requirement authentication of usage data treatment facility, there are many examples.For example, may require data processing equipment to carry out affairs, for example, with third party's (such as, long-range third party) exchange message, must communicate with this long-range third party by telecommunication link (comprise and pass through internet).This third party can require this data processing equipment, or user now, certifiedly before affairs occur meets this third party.
As mentioned above, affairs can only relate to information exchange.For example, for from third party's Download Info, may only need the user of verify data treatment facility.Such information can be the information (information that for example, relates to user's bank account) that the user of third party's representative data treatment facility preserves.Can be instead, this information can be the information of preserving on other data processing equipments, for example, belongs to that user connects or employs user's tissue or the data network of commercial entity, thereby facilitated user to access this network in user's travelling.Another possible affairs may relate to data processing equipment and download software from remote location.
In addition, affairs may require user to pay cost, so that these affairs can carry out, for example, for the information of returning third party and providing pays cost to third party.Obviously, when relating to such payment, it is very important authenticating that this user meets third party and pay with safety, simple and reliable mode.
Although data processing equipment " user " is mentioned in above-mentioned discussion, but in fact at least some above-mentioned affairs can not relate to any human user: can require data processing equipment (for example automatically to move, with role's intermittent duty of information or supervision, and report the result to third party).In this case, alternatively or additionally, perhaps data processing equipment is necessary to authenticate self to meet third party.
Data processing equipment is equipped with the device (authentication store device) for storing predetermined authentication information, or associated with such device, and this predetermined authentication information is for authenticating the specific user of this equipment or this equipment.In one embodiment, device for storing predetermined information is movably, therefore and can pick up and be inserted in any data processing equipment (or computer) that is suitable for receiving it by user, to make, for user, will can authenticate user by the affairs that this computer is carried out.Advantageously, in this case, for the device of storing predetermined information, comprise smart card.
In more specific example, smart card is at mobile or cellular telecommunication network, such as mobile especially group of GSM() or the UMTS/3G(third generation) use in handheld device in network and for authenticating such subscriber identification module or the SIM of the use of this handheld device.Although use term " SIM " here, but should be appreciated that this SIM can be the IP-based IP multimedia subsystem, IMS-IMS of 3G USIM, ISIM(), SIM or general 1C card (UICC, the smart card platform being defined by ETSI SCP, SIM, USIM, ISIM can reside on this platform).
Fig. 1 shows UMTS(3G) mobile or cellular network.Mobile terminal 1 is to UMTS(3G) mobile telecom network 3 registrations.Mobile terminal 1 can be hand phone, be equipped with laptop computer or the PDA(Personal Digital Assistant) of data card.Mobile terminal 1 is by the Radio Access Network (RAN) and mobile telecom network 3 radio communications of mobile telecom network 3, and mobile telecom network 3 comprises (in the situation that of UMTS network) base station (Node B) 5 and radio network controller (RNC) 7.Communication between mobile terminal 1 and mobile telecom network 3 is carried out route by Serving GPRS Support Node (SGSN) 9 from Radio Access Network, and Serving GPRS Support Node can be by fixing (cable) link connection to mobile telecom network 3.
In traditional mode, a plurality of other mobile terminals are to mobile telecom network 3 registrations.These mobile terminals comprise mobile terminal 11 and 13.Terminal 11 is communicated by letter with mobile telecom network 3 in the mode similar with terminal 1 with 13, via suitable Node B 5, RNC7 and SGSN9.
Each in mobile terminal 1,11 and 13 is equipped with SIM15 separately.In the manufacture process of each SIM, authentication storage information thereon under mobile telecom network 3 is controlled.The own details (comprising authentication information) that is stored in each SIM issuing under its control in SIM management function 50 of mobile telecom network 3.According to described embodiment, this authentication information comprises a plurality of cipher key sets, and cipher key sets can communicating by letter for encrypt/decrypt and SIM.
Normally in service at mobile telecom network 3, terminal 1,11 and 13 (for example authenticates by sending inquiry by network to the terminal 1,11 that contains SIM15 and 13, when user be call out or the object of call accepted and in network in activated terminals), SIM15 calculates and answers (depend on the upper predetermined information of preserving of SIM-normally identifying algorithm and unique key K i) and it is sent it back to mobile telecom network 3 in response to this inquiry.The SIM management function 50 of mobile telecom network 3 produces inquiry and it receives the answer of self terminal 1,11 and 13.Use the information of the pre-stored content about relevant SIM15, authentication function 50 calculates the desired value of the answer of self terminal 1,11 and 13.If the answer receiving is answered and mated with the expection of calculating, think that SIM15 and relevant mobile terminal (and user) pass through authentication.
Should understand under the control of mobile telecom network 3, can be to being equipped with any terminal of SIM15 to carry out such verification process.When described terminal is mobile phone handheld device, this terminal is carried out radio communication via Radio Access Network and the mobile telecom network 3 of network, although this not necessarily.For example, this terminal can be via fixed telephone network (PSTN), via UMA " access point " and/or via internet and described network service.PC23 and PDA25 also can be provided in the SIM15 under the control of described network, although and these SIM also allow authentication-be not must be by the RAN certified transmission data via network 3.
The form of carrying out the message that authentication sends depends on the type (for example SIM, USIM, ISIM, UICC) of used SIM and the type that authenticates and changing.Routinely, each assembly of the telecommunication system shown in Fig. 1 is configured to process the authentication message with a specific form in these forms.If SIM type change, this requires each in telecommunication system components to modify.Described embodiment has overcome this problem by transmit authentication message in having (transmitting) the OTA packet of reference format in the air or sealing (envelope), for example, described in ETSI and 3GPP standard TS23.048 " Security Mechanisms for the (U) SIM Application Toolkit-Stage2 ", the document is hereby incorporated by.If with this operating such, described telecommunication system, assembly can transmit described OTA packet or seal, and no matter the form of this OTA grouping or the content sealed.In fact, authentication message needs not be the conventional form for SIM, but can have different-format.
Terminal 1,11,13,23 and 25 SIM15 that use can be the SIM of defined type in GSM or UMTS standard criterion, or can be the simulation of SIM, that is to say, carry out itself can be embedded in another equipment with SIM() software or the hardware of the corresponding function of function.This SIM can be according to the configuration described in WO-A-2004036513.
It should be noted that described verification process is not the personal identification of necessary authenticated user.For example, cellular telecommunication network has prepayment subscriber, thereby this prepayment subscriber can call out because pre-post-pay paystation is sent to SIM on network.But this prepayment subscriber's identity network is not known (maybe needn't know).Yet until authenticated this user's of network SIM that is to say, such user is the specific user with the specific account of advances of this network, this user could use network.For authenticated user, such pre-pay subscriber or subscriber's SIM can be used comparably (in above-mentioned mode) or be associated with data processing equipment or computer in data processing equipment or computer.
The environment consider changing may wish to change SIM(or simulation SIM) on authentication information.For example, described SIM can be that this particular cellular telecommunications network is the network may be used on the country of usage data treatment facility or computer to the SIM of particular cellular telecommunications network registration.But, may there is wishing or must re-registering to different cellular telecommunication networks the situation (for example, moving to different countries) of SIM described equipment or computer physics.The method that can so do is in our common unsettled GB Patent Application No. 0118406.8,0122712.3 and 0130790.9 and our corresponding PCT application number GB02/003265, open in GB02/003260 and GB02/003252.As here in greater detail, SIM(and thereby simulation SIM) each authentication (and the other) information that relates to a plurality of networks can be equipped with at first, the information of heterogeneous networks can activate selectively relatively.
But user needs not to be the subscriber of communication network.Alternately, they can be the subscribers to some other central authoritiesization system registry, and this central authorities' system then can be to carry out verification process with mode identical in communication network.In this case, SIM(or simulation SIM) registration can from such central authorities' system, be sent to another in the same manner as described above.
As mentioned above, by the embodiment describing, the target of verification process is to help to realize the affairs between data processing equipment or computer and third party.In the situation that verification process is to be carried out by communication network or some other systems (this SIM user is the subscriber of these some other systems), satisfactorily the completing subsequently by this network or notifications third party, so that affairs can be proceeded of verification process.
For many affairs of described type, may relate to user to third-party payment cost.As above is the configuration of other centralization system execution verification process of its subscriber therein by communication network or user, advantageously help to have realized such payment and when payment is small amount payment (being often such situation) advantageous particularly (for example, as the payment that receives the repayment of information, such as weather or transport information, or the payment of carrying out for Interim use specific software); In this case, payment can be charged to the subscriber's that communication network or other centralization system hold account, certainly may after deduction disposal cost, be sent to third party subsequently.
The block diagram of Fig. 2 has schematically shown a kind of mode of operation said method.
Such as based on Windows(RTM) PC23 client platform comprise authenticator module 30, this authenticator module 30 forms a part for the client-end subsystem of the command history of supporting SIM application toolkit and so on, this command history provide for communicate by letter with miscellaneous equipment with the irrelevant agreement of carrier.SIM application toolkit is at ETSI and 3GPP standard TS11.11, and TS31, describes in 111, TS11.14 and TS102.223 to some extent, and described standard is not subject to copyright restrictions and is hereby incorporated by.The order of after this authenticator module 30 being supported is called " SIMTALK " order.Authenticator module 30 comprises SIMTALK interpreter, and it creates SIMTALK packet.The transmission of standardized safe OTA mechanism is used in these packets, below will be described in more detail this OTA mechanism.Provide the SIM equipment 32 wherein with SIM15, and the communication between SIM equipment 32 and authenticator module 30 can be wired or wireless connection via connecting 36() carry out.SIM equipment 32 can receive the order with treatment S IMTALK.SIM equipment 32 is mapped to card application toolkit (CAT) by the SIMTALK packet of reception, so as by SIMTALK command transfer to SIM15.CAT order is that this standard is not subject to copyright restrictions, is incorporated herein by reference as protocol command defined in ETSI SCP CAT standard TS102.223 and that carrier is irrelevant.SIM15 also can create SIMTALK packet; Use CAT that these packets are sent to SIM equipment 34.
Client application 38 is provided on PC10, and this application program allows user to obtain service from remote service operator 40.Should be understood that described " long-range " is not to be intended to hint must have specific geographic distance between PC23 and service provider 40.But common service provider 40 is independent of PC23 to be controlled, although this not necessarily.
In this embodiment, mobile telecom network 3 provides identity provider service 46, payment provider service 48 and SIM management service 50 via gateway 44.Gateway 44 can receive SIMTALK order and produce SIMTALK order.Should be understood that network 3 can be the network of any type, the present invention is not limited to mobile telecom network.For example, gateway 44 can provide in the computer that is linked to PC23 by local area network (LAN), wide area network and/or internet.
Should be understood that the possibility as button 56, can provide other device to allow PIN input.Alternatively, can be by obtaining some other security information from user and comparing authorized user to use SIM15 with the data of SIM15 storage this information.For example, the data that obtain can be user's fingerprints, or at another person's unlikely some further features that repeat with it, for example, any suitable biological attribute data.It is upper that the details of fingerprint (or out of Memory) can be stored in SIM, or by network 3ID supplier 46(or elsewhere) storage, to compare with the input data of representation feature.
In superincumbent description, point out for the SIM of authenticating transactions, to there is the form of the conventional SIM being equipped with in Doyle chip 32.This can be simply mobile network's the SIM that subscriber calls out in their conventional mobile phone handheld device and receipt of call is used.Alternatively, SIM15 is directly installed to movably PC23 or is embedded in (SIM can not be removed or can not be removed completely easily like this) among PC23.Further alternatively, SIM can not have independently physical form, but can simulate by software and/or hardware in PC23 or Doyle chip 32.SIM can simulate or merge in the chipset of PC23.For example, SIM can merge or simulate in the central processor unit of PC23.Such configuration prevent SIM(or simulation SIM) from PC23, remove (and except by performance PC23 useless).
If SIM is the form that can not remove from PC23 or Doyle chip 32 easily, the subscriber of telecommunication system can be equipped with in the mobile phone handheld device that the 2nd SIM is for example used in them.
But, for example, if (in PC23 or Doyle chip 32) carrys out authenticating transactions and in a usual manner for communication network (with identical SIM, use mobile phone handheld device to call out and receipt of call), can provide the authentication to affairs by the identical data of the data of using when utilizing mobile telephone network authentication SIM when calling out.Alternatively, SIM can have for carrying out the separate records of every kind of auth type.Can have and be included in the data used in authenticating transactions and/or the first record of algorithm, and for utilize the second separate records of communication network authentication terminal with normal mode.The first and second records can have authenticate key separately, for the unique identifier of communication network and/or unique identifying algorithm.Do not need to utilize network 3 these mobile phone handheld devices of authentication to be PC23 authenticating transactions for SIM.
As PC23 together with the SIM15 with its coupling by initial power-up time, or when SIM15 by coupling (via SIM equipment 32) for the first time to opened PC23 time, the initialization procedure of execution as shown in the flow chart of Fig. 4.
The identity provider 46 that authenticator module 30 belongs to from the data of this SIM of SIM15 request mark and it and the expression of gateway 44 (that is to say, under the control of SIM management function 50, issue this SIM15, SIM management function 50 is associated with identity provider and gateway)-step a.These requests of 30 pairs of data from SIM15 of authenticator module are sent to SIM equipment 32 from authenticator module 30.SIM equipment 32 is transmitted to SIM15-step b by described request.SIM15 returns to its identity data, gateway 44 address and its identity provider 46 address-step c.SIM equipment 32 by this data retransmission to authenticator module 30-steps d.
Authenticator module 30 subsequently contact service gateway 44 with from its request initialization data-step e.Authenticator module 30 can be equipped with " overall situation " key, for example, offers the key of all authenticator module 30 of issuing under the control of network 3.Such key in force can obfuscation.In addition, if jeopardize secret key safety, new key more.Authenticator module 30 provide described global secret to gateway 44 to confirm the integrality of authenticator module 30.This initialisation data request sends identity provider 46 to by gateway 44.Identity provider checks SIM identity data, gateway 44 address and identity provider 46 address, and if determine that this information is correct, identity provider 46 is that gateway 44 produces initialization data, and this initialization data makes gateway 44 can be established to OTA communication path (via authenticator module 30 and SIM the equipment 32)-step f of SIM15.As mentioned above, authentication information YouID supplier 46 storages of each SIM.ID supplier 46 selects suitable cipher key sets (using the cipher key sets data that obtain from SIM management function 50) to encrypt the content of the OTA packet sending by described communication path.The header of each OTA packet comprises the indication (for example, SMS text message, authentication message etc.) of the type of OTA packet and the indication (but not being key itself) of selected cipher key sets.This header data is received by SIM15.If specified data grouping is authentication message, extract SIMTALK order and identification cipher key sets designator.The counterpart keys set that access provides in manufacture process in this SIM, and with this counterpart keys set, decipher the message receiving from gateway in the communication session of nowadays setting up.Alternatively, can send new cipher key sets and in SIM management function 50, store corresponding cipher key sets to SIM, to can use new cipher key sets encrypting messages.
OTA packet is that this standard is not subject to copyright restrictions, is hereby incorporated by by the defined reference format of ETSI3GPP standard TS23.048.OTA packet is irrelevant with carrier.This OTA packet is not to transmit by OTA.They can transmit or by comprising fixing (wired) Internet Transmission of internet by OTA.
Flow chart referring now to Fig. 5 A and 5B.
When subscriber wants to use the service (steps A of the flow chart shown in Fig. 5 A) being provided by remote service operator 40, subscriber is by being inserted into their Doyle chip that comprises SIM15 32 the suitable link slot of PC23 or using wireless link that their SIM15 is coupled to PC23(step B).Subscriber activates client application relevant on this PC23 32 subsequently to obtain required service (step C).For example, client application 32 can be to provide or be arranged on the special software on subscriber's PC23 by service provider 40 under it is controlled.Alternatively, client application 32 can be the web browser for the suitable website of access services operator 40.
For the operation of the system shown in key diagram 2, will provide an example, wherein subscriber wants to buy a specific CD from vendor, and this seller is service provider 40.The graphic user interface that use presents on PC23, the web browser software providing on PC23 is provided subscriber, and via the 40 of the Internet access services operator website.This web browser software forms client application 32, and allows the website that access is relevant to the service provider 40 of selling CD.
Data communication between client application 32 and service provider 40 can for example, by fixed network (PSTN) or be undertaken by wireless network, this wireless network such as network 3 or another mobile telecom network.
Subscriber inputs the desired details of service provider 40 (such as their name and address)-step D subsequently.
Subscriber searches for described website and wants with identification subscriber the CD buying.When identifying the required CD of this subscriber, subscriber makes client application 32 send service request information (step e) to service provider 40, for example, clicks the button of " purchase CD " that Gai website provides by mouse.Described message comprise identify required CD data, sign subscriber data (such as subscriber's SIM identifier), this sign subscriber's data comprise that expression subscriber has installed the field of authenticator module 30 on their PC, and this authenticator module 30 can authenticating transactions by subscriber's SIM15.
In this stage of affairs, some details of subscriber being provided to service provider 40, comprises that subscriber's name, address and they want the CD ordering.This information can be by not being that someone of subscriber provides.For authenticating transactions, service provider 40 has built service context Sc(step F).Service context is the packet that comprises following field:
The identifier of zero service provider 40
Zero subscriber's name (or other identifier, such as SIM identifier)
The details of zero affairs that will authenticate (being to buy CD in this example)
Currently also can provide other or optional information.
Service context Sc sends to client application 32 via internet.Client application 32 sends service context Sc to authenticator module 30(step G).Client application 32 can add its identifier to service context Sc, so that network 3 can be determined these affairs, comes from which client application.
Authentication module 30 Analysis Service contexts, and determine and need to ask by 3 pairs of these transaction authentications of network.Authentication module 30 detects the subscriber's who whether has the SIM15 that comprises subscriber Doyle chip 32(step H).If there is no Doyle chip 32, and reminding user makes their Doyle chip use.Authentication module 30 can also show the explanation of the affairs that will authenticate, and provides option to approve these affairs or do not approve these affairs to subscriber.Suppose and have Doyle chip, and subscriber approved this affairs, authentication module 30 sends the request of security token Sx (step I) with the rear gateway 44 to network 3.This request that sends to gateway 44 comprises service context Sc.These data can be passed through any suitable Internet Transmission.For example, these data can be via internet transmissions.These data can be transmitted by fixed telephone network, or by communication network 3 transmission of mobile or honeycomb.
Subscriber will be authenticated by gateway 44 after this, and gateway 44 is carried out inquiry and response session (by sending data via the authenticator module 30)-step J with SIM.Gateway 44 will send random enquire to authenticator module 30, and this inquiry is transferred to SIM15.This inquiry sends as OTA packet, and this OTA packet is encrypted by selected cipher key sets in the above described manner.SIM is used the counterpart keys set of the upper storage of SIM to decipher this OTA packet.Then extract the inquiry of deciphering.SIM15 is by with identifying algorithm with reside in this SIM15 and unique key K i of distributing to this certain subscriber encrypts described random enquire and responds.Use selected cipher key sets encrypt this response and this response is encapsulated in OTA packet, this OTA packet has the header that shows used cipher key sets (and the character of this OTA packet and destination).This OTA packet is transferred to gateway 44 via authenticator module 30.The cipher key sets data that gateway 44 use obtain from SIM management function 50 via ID supplier 46 are deciphered OTA packet.Then the SIM of this deciphering response is sent to ID supplier 46.ID supplier 46 analyzes this response, to determine whether this response is the response of the SIM15 from that subscriber of expection.If described response is the response of expection, gateway 44 sends security token Sx, and this service token is sent to authenticator module 30(step K).Authenticator module 30 oneself do not need to understand the data that exchange in inquiry and response process-it as these data pipeline-in fact, it can not decipher described OTA packet because cipher key sets is unknown to it.
As additional safety measure, the OTA challenge data packet that gateway 44 produces can comprise that requirement subscriber provides the SIMTALK order of some secure datas (such as PIN or biological attribute data).This SIMTALK order is extracted and is carried out by SIM.SIM sends order to point out user use button 56 their PIN(of input or biological attribute data is provided with rear to SIM equipment 32).This PIN(or biological attribute data) be encapsulated in the response OTA packet of encryption, and compare with the biological attribute data that pre-stored PIN or subscriber had previously offered ID supplier 46.
SIM15 comprises the private data such as identifying algorithm and unique key K i.These data are not obtained very important by unverified side.When combining with mobile phone handheld device with general fashion, SIM makes for calling out or when call accepted, the private data on SIM is not vulnerable, because serving as reasons according to the mobile phone handheld device access SIM of strict international standard operation.The mobile phone handheld device of only deferring to these standards is allowed to use together with mobile telecom network with SIM.But as designed in the present embodiment, when SIM and PC23 coupling, the private data on SIM can be accessed by any application program of any application program on PC23 or access PC23 potentially.When therefore, the private data on SIM15 is used in a usual manner than SIM in mobile phone handheld device, more easily suffer unverified access.
According to a feature of the present invention, SIM15 is configured to only allow PC23 to carry out limited access to the data on this SIM.Can have several different SIM security mechanisms, it can be selected by user or network 3.
In pattern 1, the application program on PC23 can only read identification data, such as SIM ID, the SIM person of sending ID, HeID supplier 46 address, gateway 44 address.PC23 can not obtain any other data from SIM15, thereby has protected the private data of the upper storage of SIM15.
In pattern 2, the communication between SIM15 and PC23 is encrypted.The only application program that is allowed to access the PC23 of SIM15 is authenticator module 30.The software of realizing authenticator module 30 comprises public-private cipher key pair.These keys can be arranged on PC23 before PC23 is distributed to subscriber together with authenticator module software.Alternatively, authenticator module 30 softwares and key can be distributed to subscriber on the recordable media such as CD-ROM, to be arranged on PC23.When PC23 is by initial power-up, or when using Doyle chip 34 that SIM15 is newly connected to PC23, SIM15 sends the SIMTALK order of its public keys of request and certificate to authenticator module.On SIM15, there is the pre-stored root certificate relevant to authenticator module 30 on it, and can check the certificate of authenticator module 30 effective.SIM15 determines that the certificate of authenticator module 30 is effective, and SIM15 produces session key, and this session key is sent to authenticator module 30.Authenticator module 30 is used communicating by letter of this secret key encryption and SIM15 subsequently.Know that this session key makes SIM15 can decipher these communications.Therefore any communication that SIM15 can suppose this session key of use is from believable authenticator module (because this authenticator module has effective certificate).Advantageously, network 3 provides the renewal of valid certificate every now and then to SIM15.If network 3 is known authenticator module 30 and threatened in some way safety, will abolish the certificate of this authenticator module, and to the SIM15 of sending.When authenticator module 30 sends to SIM15(for example its public keys and certificate, when PC23 powers up), SIM15 will detect this certificate and abolish, and not send session key, and under this safe mode, the communication between authenticator module 30 and SIM15 is impossible like this.
Described safe mode 3 above in detail, its permission is set up OTA communication channel between SIM15 and gateway 44.But, such OTA communication channel be merely able to for when GSM/3G inquiry and response process have been successfully completed to SIM15 transmission SIMTALK order.That is to say, the communication in this safe mode will only may be carried out between gateway 44 and SIM15.Although OTA packet is via authenticator module 30 transmission, authenticator module 30 can not be accessed the content of this packet, because they are to use to only have DuiID supplier 46(and SIM management function 50) and the known cipher key sets encryption of SIM15.
Other optional safe mode also can be provided.
Refer again to the flow chart of Fig. 5 B, after authentication has successfully finished, if require the payment to these affairs, the details of desired payment is included in service context Sc.This information is extracted from service context Sc by gateway 44.Gateway 44 can send message to payment provider 48 subsequently, and payment provider 48 is in subscriber's reserves funds in the account of network 3.
Security token Sx is transmitted to client application 38(step L).
Client application 38 sends security token to service provider 40(step M subsequently).
Security token Sx comprises the data that are exclusively used in certain subscriber and have the affairs of the details that service provider 40 provides.Many affairs can be by network 3, authenticator module 30 and service provider 40 parallel processings.Owing to being exclusively used in the data of the particular transaction with the details that service supplier 40 provides in security token Sx, these affairs can be distinguished from each other out.
If security token Sx is intercepted when passing through between network 3 and authenticator module 30 or between client application 38 and service provider 40, this security token is not worth interceptor.Security token Sx is exclusively used in, and the particular transaction of details and the providing the service of certain subscriber that service provider 40 provides is provided.
When service provider 40 receives security token Sx, its content is analyzed, and if determine its service context Sc sending corresponding to service provider 40, service provider 40 can be supposed this request (order of CD) of service is made by subscriber is legal.Service provider 40 can offer security token Sx identity provider 46, to detect the validity of this token.Identity provider 46 is checked subsequently the integrality (for example, checking it whether to be sent or sent by another believable identity provider by identity provider 46) of security token Sx and is verified the content of this security token Sx.Identity provider 46 sends and indicates this security token Sx effectively to respond to service provider 40 with rear.Alternatively, gateway 44 can send data to service provider 40, and these data make service provider 40 oneself to determine the completeness and efficiency of this security token Sx.Then can send this CD with charge free.If require to pay, service supplier 22 can produce payment context Pc and use this payment context to utilize network 3 from user's account, to obtain payment in the mode of describing in WO-A-2004036513.Certainly can use other method paying that obtains.
As mentioned above, the communication between PC23 and network 3 is preferably encrypted.For the communication between the assembly in the communication between the assembly in PC23 and network 3, also preferably encrypt, for example, by using shared key.According to an aspect of the present invention, can revise the PC23 described in superincumbent embodiment to comprise complete data card module (that is to say, for the equipment of the Radio Access Network radio communication with communication network 3).For the PC23 of equipment like this can be communicated by letter with mobile telecom network 3, must SIM15 is relevant to described module to help to realize the authentication that utilizes network 3.Advantageously, SIM15 can remove from PC easily.For example, SIM can be inserted in the SIM card holding tank providing on PC movably, or uses Doyle chip to be connected to PC in above-mentioned mode.If via the operating system access data card module of PC23, this will mean that any verify data of transmitting between SIM15 and this module can be by any softward interview on PC.This may mean that verify data becomes known for unverified side.According to this aspect of this embodiment, data card module is configured to (only) via the BIOS(basic input/output of PC23) communicate by letter with SIM15.Therefore can between SIM15 and described module, communicate and via operating system, not send verify data.
Claims (37)
1. a method for certification entity, the method comprises to this entity provides authentication store device (15), on this authentication store device, stores authentication information; Via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) this authentication store device (15) is coupled to authenticate device (50), to utilize authenticate device (50) to authenticate this entity; It is characterized in that described data in thering is communication network described in each element (5,7,9) can identify and the message of the preassigned message format that can transmit in transmit, described message has for transmitting described data to utilize described authenticate device (50) to authenticate the first auth type of this entity, and this message format can also be by element described in each for transmitting non-verify data with the second standard message type.
2. method claimed in claim 1, wherein said message format is corresponding to aerial (OTA) message format that transmits.
3. the method described in claim 1 or 2, wherein said authentication store device (15) comprises smart card.
4. method claimed in claim 3, wherein said authentication store device (15) comprises Subscriber Identity Module or SIM.
5. the method described in claim 3 or 4, wherein said authentication store device (15) comprises for utilizing GSM or UMTS(3G) mobile telecom network authenticates the data of described entity.
6. method claimed in claim 5, the authentication information being wherein stored on authentication store device (15) can be used for utilizing mobile telecom network authentication mobile phone handheld device.
7. the method described in any one in claim 1 to 6, wherein said authenticate device (15) is relevant to GSM or UMTS mobile telecom network.
8. the method described in any one in claim 1 to 7, wherein said communication network comprises GSM or UMTS mobile telecom network.
9. the method described in any one in claim 1 to 8, wherein said communication network comprises internet.
10. the method described in any one in claim 1 to 9, wherein said authentication store device (15) is coupled to carrier (32).
Method in 11. claims 1 to 10 described in any one, comprises authentication store device (15) is coupled to data processing equipment (23), so that the affairs that authentication is used this data processing equipment (23) to carry out.
Method described in 12. claims 11, wherein message is transmitted via described data processing equipment (23).
Method described in 13. claims 10,11 or 12, comprises via carrier (32) described authentication store device (15) is coupled to described data processing equipment (23).
Method in 14. claims 10 to 13 described in any one, wherein said message is transferred to described authentication store device (15) via described carrier (32).
Method in 15. claims 10 to 14 described in any one, wherein said message comprises for reminding described carrier to obtain the element of identity data.
Method described in 16. claims 15, wherein said identity data comprises PIN or biological attribute data.
Method described in 17. claims 15 or 16, wherein said identity data is transferred to described authenticate device.
Method in 18. claims 1 to 17 described in any one, wherein said message comprises for by these message and the differentiation element separating for transmitting the message area of non-verify data.
Method described in 19. claims 18, wherein said differentiation element is explained by described authentication store device (15).
Method in 20. claims 1 to 18 described in any one, wherein said authentication store device (15) and described authenticate device (50) are equipped with corresponding encryption and decryption mechanism.
Method described in 21. claims 20, is included in and between described authentication store device (15) and authenticate device (50), sets up a kind of in described mechanism and according to the data in message described in this encryption mechanism.
Method in 22. claims 11 to 14 described in any one, wherein via basic input/output (BIOS) certified transmission data between this data processing equipment (23) and described authentication store device (15) of described data processing equipment (23).
Method described in 23. claims 22, wherein said data processing equipment (23) and described mobile telecom network (3) radio communication.
Method described in 24. claims 23, wherein said data processing equipment (23) comprises mobile communications data card.
Method described in 25. claims 11, comprise from described data processing equipment (23) to authentication store device (15) transfer of security data, use authentication store device (15) to check the validity of this secure data, and only have definite secure data effectively just to exchange selected data with data processing equipment (23).
Method described in 26. claims 25, comprise do not consider the existence of described secure data or validity and with data processing equipment (23) exchange tentation data.
Method in 27. claims 1 to 26 described in any one, wherein said message comprises from the inquiry of described authenticate device (50) with from the corresponding answer of authentication store device (15).
28. 1 kinds of equipment for certification entity, this equipment comprises authentication store device (15), on this authentication store device, stores authentication information; Authenticate device (50), via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) authenticate device (50) is coupled to this authentication store device (15), to utilize authenticate device (50) to authenticate this entity; It is characterized in that for have communication network (3) described in each element can identify and the message of the preassigned message format that can transmit in transmit the device of described data, described message has for transmitting described data to utilize described authenticate device (50) to authenticate the first auth type of this entity, this message format can also be by element described in each (5,7,9) for transmitting non-verify data with the second standard message type.
Equipment described in 29. claims 28, wherein said message format is corresponding to aerial (OTA) message format that transmits.
Equipment described in 30. claims 28 or 29, comprises for executing claims the device of 1 to 27 method described in any one.
31. 1 kinds of authentication store devices (15) for certification entity, on this authentication store device, store authentication information, this authentication store device (15) is via a plurality of elements (5 for the communication network (3) of swap data between this authentication store device (15) and authenticate device (50), 7,9) can be connected to authenticate device (50), to utilize authenticate device (15) to authenticate this entity; It is characterized in that for have communication network (3) described in each element (5,7,9) can identify and the message of the preassigned message format that can transmit in transmit the device of described data, described message has for transmitting described data to utilize described authenticate device (50) to authenticate the first auth type of this entity, this message format can also be by element described in each (5,7,9) for transmitting non-verify data with the second standard message type.
Authentication store device described in 32. claims 31, wherein said message format is corresponding to aerial (OTA) message format that transmits.
Authentication store device described in 33. claims 31 or 32, wherein said authentication store device (15) comprises smart card.
Authentication store device described in 34. claims 33, wherein said authentication store device (15) comprises subscriber identification module or SIM.
Authentication store device described in 35. claims 33 or 34, wherein said authentication store device (15) comprises for utilizing GMS or UMTS(3G) mobile telecom network authenticates the data of described entity.
Authentication store device described in 36. claims 35, the authentication information being wherein stored on authentication store device (15) can be used for utilizing described mobile telecom network (3) authentication mobile phone (1) handheld device.
Authentication store device in 37. claims 31 to 36 described in any one, comprises for executing claims the device of 1 to 27 method described in any one.
Applications Claiming Priority (4)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| GB0506570.1 | 2005-03-31 | ||
| GBGB0506570.1A GB0506570D0 (en) | 2005-03-31 | 2005-03-31 | Facilitating and authenticating transactions |
| GB0507587.4 | 2005-04-14 | ||
| GB0507587A GB2424807B (en) | 2005-03-31 | 2005-04-14 | Facilitating and authenticating transactions |
Related Parent Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200680019419.5A Division CN101189616A (en) | 2005-03-31 | 2006-02-23 | Facilitating and authenticating transactions |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN103516713A true CN103516713A (en) | 2014-01-15 |
Family
ID=34566781
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310246532.9A Pending CN103516713A (en) | 2005-03-31 | 2006-02-23 | Facilitating and authenticating transactions |
| CN200680019419.5A Pending CN101189616A (en) | 2005-03-31 | 2006-02-23 | Facilitating and authenticating transactions |
Family Applications After (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200680019419.5A Pending CN101189616A (en) | 2005-03-31 | 2006-02-23 | Facilitating and authenticating transactions |
Country Status (5)
| Country | Link |
|---|---|
| US (1) | US8737964B2 (en) |
| EP (1) | EP2381386A1 (en) |
| JP (1) | JP5154401B2 (en) |
| CN (2) | CN103516713A (en) |
| GB (2) | GB0506570D0 (en) |
Families Citing this family (35)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1881434A1 (en) * | 2006-06-09 | 2008-01-23 | Axalto SA | A personal token having enhanced signaling abilities |
| EP1919156A1 (en) * | 2006-11-06 | 2008-05-07 | Axalto SA | Optimized EAP-SIM authentication |
| HU230695B1 (en) * | 2007-10-20 | 2017-09-28 | Andrá Vilmos | Method of preparing storing and method of storing single user access information into safe storage unit of a communication device |
| JO2532B1 (en) * | 2008-03-09 | 2010-09-05 | أنس محمود السهلي محمود | Subscriber Identity Module (SIM) Chip Bank System and Method |
| US8799171B2 (en) * | 2008-04-01 | 2014-08-05 | International Business Machines Corporation | Secure online banking transaction apparatus and method |
| US8312033B1 (en) | 2008-06-26 | 2012-11-13 | Experian Marketing Solutions, Inc. | Systems and methods for providing an integrated identifier |
| CN101727706B (en) * | 2008-10-24 | 2013-06-05 | 中兴通讯股份有限公司 | Electronic payment system and method for updating mobile user numbers corresponding to intelligent cards |
| EP2182479A1 (en) * | 2008-11-03 | 2010-05-05 | Gemalto SA | A method for communicating an authorization response cryptogram to an external entity, and a corresponding system |
| US9497632B2 (en) * | 2009-10-01 | 2016-11-15 | T-Mobile Usa, Inc. | System and method for pairing a UICC card with a particular mobile communications device |
| ES2375861B1 (en) * | 2010-03-29 | 2013-01-29 | Vodafone España, S.A.U. | SYSTEM AND METHOD TO MANAGE AUTOMATIC AUTHENTICATION TO INTERNET OBJECTIVE RESOURCES. |
| CN102457374A (en) * | 2010-10-18 | 2012-05-16 | 卓望数码技术（深圳）有限公司 | Safety authentication method of mobile terminal and system thereof |
| US9408066B2 (en) | 2010-12-06 | 2016-08-02 | Gemalto Inc. | Method for transferring securely the subscription information and user data from a first terminal to a second terminal |
| EP2461613A1 (en) | 2010-12-06 | 2012-06-06 | Gemalto SA | Methods and system for handling UICC data |
| US20140019760A1 (en) * | 2010-12-06 | 2014-01-16 | Gemalto Sa | Method for personalizing a secure element comprised in a terminal |
| US9607336B1 (en) | 2011-06-16 | 2017-03-28 | Consumerinfo.Com, Inc. | Providing credit inquiry alerts |
| FR2977418B1 (en) * | 2011-06-28 | 2013-06-28 | Alcatel Lucent | AUTHENTICATION SYSTEM VIA TWO COMMUNICATION DEVICES |
| US9094774B2 (en) | 2012-05-14 | 2015-07-28 | At&T Intellectual Property I, Lp | Apparatus and methods for maintaining service continuity when transitioning between mobile network operators |
| US9148785B2 (en) * | 2012-05-16 | 2015-09-29 | At&T Intellectual Property I, Lp | Apparatus and methods for provisioning devices to utilize services of mobile network operators |
| US8800015B2 (en) | 2012-06-19 | 2014-08-05 | At&T Mobility Ii, Llc | Apparatus and methods for selecting services of mobile network operators |
| US9473929B2 (en) | 2012-06-19 | 2016-10-18 | At&T Mobility Ii Llc | Apparatus and methods for distributing credentials of mobile network operators |
| US20130346571A1 (en) * | 2012-06-24 | 2013-12-26 | Sergei MAKAVEEV | Computer and method of operation of its network |
| US10664936B2 (en) | 2013-03-15 | 2020-05-26 | Csidentity Corporation | Authentication systems and methods for on-demand products |
| US9633322B1 (en) | 2013-03-15 | 2017-04-25 | Consumerinfo.Com, Inc. | Adjustment of knowledge-based authentication |
| US9721147B1 (en) | 2013-05-23 | 2017-08-01 | Consumerinfo.Com, Inc. | Digital identity |
| WO2015166216A1 (en) | 2014-05-02 | 2015-11-05 | Barclays Bank Plc | Transaction authentication |
| US10373240B1 (en) | 2014-04-25 | 2019-08-06 | Csidentity Corporation | Systems, methods and computer-program products for eligibility verification |
| US10417634B1 (en) * | 2014-08-29 | 2019-09-17 | Amazon Technologies, Inc. | On-line transaction verification service and apparatus |
| WO2016149207A1 (en) * | 2015-03-13 | 2016-09-22 | The North Face Apparel Corp. | Energy harvesters, energy storage, and related systems and methods |
| GB201506045D0 (en) * | 2015-04-09 | 2015-05-27 | Vodafone Ip Licensing Ltd | SIM security |
| US20170169420A1 (en) * | 2015-12-14 | 2017-06-15 | WIBMO Inc. | One-step payments in a secure digital platform |
| CN106909824A (en) * | 2015-12-22 | 2017-06-30 | 北京握奇智能科技有限公司 | A kind of ciphering and deciphering device and method |
| US20180248869A1 (en) * | 2017-02-28 | 2018-08-30 | Panasonic Intellectual Property Management Co., Ltd. | Mobile device theme park or resort experience dongle |
| US10911234B2 (en) | 2018-06-22 | 2021-02-02 | Experian Information Solutions, Inc. | System and method for a token gateway environment |
| US11941065B1 (en) | 2019-09-13 | 2024-03-26 | Experian Information Solutions, Inc. | Single identifier platform for storing entity data |
| US11877218B1 (en) | 2021-07-13 | 2024-01-16 | T-Mobile Usa, Inc. | Multi-factor authentication using biometric and subscriber data systems and methods |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN2449287Y (en) * | 2000-09-05 | 2001-09-19 | 上海力保科技有限公司 | Automatic internet ticket selling machine capable of ordering ticket with mobile telephone set |
| US20030012159A1 (en) * | 2001-07-13 | 2003-01-16 | Dan Vassilovski | System and method for mobile station authentication using session initiation protocol (SIP) |
| WO2004036467A1 (en) * | 2002-10-17 | 2004-04-29 | Vodafone Group Plc. | Facilitating and authenticating transactions |
Family Cites Families (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP3564899B2 (en) | 1996-10-25 | 2004-09-15 | 凸版印刷株式会社 | IC card and IC card system |
| US20010045451A1 (en) | 2000-02-28 | 2001-11-29 | Tan Warren Yung-Hang | Method and system for token-based authentication |
| GB2378098B (en) * | 2001-07-27 | 2005-04-13 | Vodafone Plc | Telecommunications systems and smart cards use therewith |
| FI114953B (en) * | 2001-09-28 | 2005-01-31 | Nokia Corp | The method of identifying the user on the terminal, the identification system, the terminal and the authentication device |
| US7343490B2 (en) * | 2001-11-30 | 2008-03-11 | Nokia Siemens Networks Oy | Apparatus, and associated method, for facilitating authentication of a mobile station with a core network |
| US7149545B2 (en) * | 2002-05-30 | 2006-12-12 | Nokia Corporation | Method and apparatus for facilitating over-the-air activation of pre-programmed memory devices |
| US7280847B2 (en) * | 2002-07-26 | 2007-10-09 | Way Systems Inc | System and method for mobile transactions using the bearer independent protocol |
| GB2396707B (en) * | 2002-10-17 | 2004-11-24 | Vodafone Plc | Facilitating and authenticating transactions |
| GB2394327B (en) * | 2002-10-17 | 2006-08-02 | Vodafone Plc | Device for facilitating and authenticating transactions |
| GB2406925B (en) * | 2003-10-09 | 2007-01-03 | Vodafone Plc | Facilitating and authenticating transactions |
-
2005
- 2005-03-31 GB GBGB0506570.1A patent/GB0506570D0/en not_active Ceased
- 2005-04-14 GB GB0507587A patent/GB2424807B/en active Active
-
2006
- 2006-02-23 CN CN201310246532.9A patent/CN103516713A/en active Pending
- 2006-02-23 JP JP2008503568A patent/JP5154401B2/en active Active
- 2006-02-23 US US11/910,230 patent/US8737964B2/en active Active
- 2006-02-23 EP EP10182910A patent/EP2381386A1/en not_active Withdrawn
- 2006-02-23 CN CN200680019419.5A patent/CN101189616A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN2449287Y (en) * | 2000-09-05 | 2001-09-19 | 上海力保科技有限公司 | Automatic internet ticket selling machine capable of ordering ticket with mobile telephone set |
| US20030012159A1 (en) * | 2001-07-13 | 2003-01-16 | Dan Vassilovski | System and method for mobile station authentication using session initiation protocol (SIP) |
| WO2004036467A1 (en) * | 2002-10-17 | 2004-04-29 | Vodafone Group Plc. | Facilitating and authenticating transactions |
Also Published As
| Publication number | Publication date |
|---|---|
| JP5154401B2 (en) | 2013-02-27 |
| GB2424807B (en) | 2009-12-23 |
| US20090215431A1 (en) | 2009-08-27 |
| EP2381386A1 (en) | 2011-10-26 |
| JP2009500696A (en) | 2009-01-08 |
| US8737964B2 (en) | 2014-05-27 |
| GB2424807A (en) | 2006-10-04 |
| CN101189616A (en) | 2008-05-28 |
| GB0507587D0 (en) | 2005-05-18 |
| GB0506570D0 (en) | 2005-05-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103516713A (en) | Facilitating and authenticating transactions | |
| CN108496382B (en) | Secure information transmission system and method for personal identity authentication | |
| Schwiderski-Grosche et al. | Secure mobile commerce | |
| RU2411670C2 (en) | Method to create and verify authenticity of electronic signature | |
| US8335925B2 (en) | Method and arrangement for secure authentication | |
| EP1216538B1 (en) | Method and apparatus for executing secure data transfer in a wireless network | |
| CN100583883C (en) | Method of providing a signing key for digitally signing, verifying or encrypting data and mobile terminal | |
| JP6704919B2 (en) | How to secure your payment token | |
| CN108476223B (en) | Method and apparatus for SIM-based authentication of non-SIM devices | |
| CN101164086A (en) | Methods, system and mobile device capable of enabling credit card personalization using a wireless network | |
| CN102314576A (en) | In NFC equipment, carry out the method for Secure Application | |
| CN101599117B (en) | System and method for providing code signing services | |
| US20140052992A1 (en) | Response to Queries by Means of the Communication Terminal of a User | |
| KR101206072B1 (en) | System and Method for Managing Private Information | |
| EP1715437A2 (en) | Controlling data access | |
| WO2006103383A1 (en) | Facilitating and authenticating transactions | |
| Dass et al. | Security framework for addressing the issues of trust on mobile financial services | |
| Pohlmann et al. | SIM-enabled open mobile payment system based on nation-wide PKI | |
| KR20140143130A (en) | Secured mobile phone payment system for using personal identification number and method thereof | |
| KR20170023400A (en) | Method for Processing Payment based on Application Program by using One Time Password | |
| Rossnagel | Mobile Qualified Electronic Signatures | |
| KR20160053867A (en) | Method for Processing Payment based on Application Program by using One Time Password | |
| KR20020087656A (en) | Method for certifying a right user using a wireless communication apparatus | |
| KR20100136361A (en) | System and method for processing mobile phone small sum of money settlement, server and recording medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20140115 |